How to write secure code

Characteristics

Following major attacks on national infrastructures, security professionals discovered that most vulnerabilities resulted from flawed and vulnerable code. Developers must now master secure coding techniques, as we are in a situation where anyone can use available tools to write a script that effectively disables a large organization's systems. In this course, you will learn the details of the latest cyberattacks and the countermeasures used to stop and prevent these attacks. You will see what mistakes contributed to the creation of vulnerabilities. By participating in the labs, you will put security controls into practice and gain the experience and knowledge necessary to create secure code.

Upon completion of the course, participants will be able to:

• Master secure coding techniques.
• Test application security before deployment to a production environment.
• Understand application-related risks from a software architect's perspective.
• Establish basic security principles for development teams.
• Configure servers to avoid vulnerabilities and configuration errors.

Course format

• Interactive lecture and discussion.
• Lots of exercises and practice.
• Practical implementation in a live lab environment.

Requirements

• Basic knowledge of any programming language.
• Basic knowledge of the software development life cycle.

Target audience

• Web, mobile, Java, and .NET developers.
• Software architects.
• Software testers.
• Security professionals.
• Webmasters.

Module 1: Introduction to secure coding

• Overview of secure coding practices
• Common software vulnerabilities
• Importance of a secure software development lifecycle

Module 2: Basics of web, Windows, and mobile applications

• Introduction to application platforms
• Security implications for each platform
• Best practices for secure development

Module 3: Application attacks and exploits

• Cross-Site Scripting (XSS)
• SQL Injection
• Cross-Site Request Forgery (CSRF)

Module 4: Server attacks and exploits

• Denial of Service (DoS) attacks
• Buffer Overflow (BOF)
• Common server vulnerabilities

Module 5: Validation and verification

• Input validation techniques
• Data sanitization and output encoding
• Verification of security measures

Module 6: Security controls and countermeasures

• Implementing access control
• Using encryption to protect data
• Protection against common threats

Module 7: Secure mobile application coding

• Security considerations in mobile app development
• Implementing secure mobile app architectures
• Secure mobile data management

Module 8: Security standards and testing

• Overview of security standards (e.g., OWASP)
• Vulnerability testing
• Best practices for security testing